7aca4b4e58c8092addfb1a56c665827ff04168562f6a6303d21b60e606af875f

General

Target

7aca4b4e58c8092addfb1a56c665827ff04168562f6a6303d21b60e606af875f.dll
Size

315KB
MD5

4af612fbff91936fb2f780ea5ca307cf
SHA1

5fbc771ba729b7717278502838ac879322e2c18f
SHA256

7aca4b4e58c8092addfb1a56c665827ff04168562f6a6303d21b60e606af875f
SHA512

3863319881675dd7c42958a25af8cfcabe6f5fb5498e2f40efafe937f1d245d4da57a5e1bbc23f471fb1dff4c330938eb1d25775a2e7ca01fb75938c8d0ac9ee
SSDEEP

3072:yezWpGOdJXncK5FLCVMZVDtkOPwSYpAHYzxTDtbWzLaSxRW4bGtVHq1ySe6gVvvm:ah5FLZVDtkObHYl99WQlHq4OgVvv4

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\Version\ = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E6D8684-755D-4847-BF40-68EC5E4BC1E9}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.MailMerge	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AED3A6B3-2171-11D2-B77C-0008C73ACA8F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.POP3	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23E86816-772B-4B28-A924-A135CFF6469A}\ = "IPGPKeys"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10E321CC-683E-4060-B938-4F53234D9593}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResult\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{684130B2-2B8A-4E8D-BE71-8F4052882076}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1CC9084-0177-4136-9B1B-C06C061F1E1D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14E61A41-8846-11D2-B7E4-0008C73ACA8F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08B9999C-DAD2-4353-B25B-8CCAFFCA4D16}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}\ProgID\ = "jmail.PGPDecodeResults"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{952F0B99-50B6-44B3-AE0D-700D5B98B416}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBAAEA4B-AD29-47BD-8776-C787D5BE28AA}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Recipient\Clsid\ = "{DBAAEA4B-AD29-47BD-8776-C787D5BE28AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{607A06FE-2FDA-4ADC-854D-D016D98D83DB}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23E86816-772B-4B28-A924-A135CFF6469A}\TypeLib\Version = "4.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AED3A6B3-2171-11D2-B77C-0008C73ACA8F}\ProgID\ = "jmail.SMTPMail"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{952F0B99-50B6-44B3-AE0D-700D5B98B416}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E61A41-8846-11D2-B7E4-0008C73ACA8F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Attachment\Clsid\ = "{53DECA78-C334-4235-9165-1FE7D8912A76}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{952F0B99-50B6-44B3-AE0D-700D5B98B416}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14E61A41-8846-11D2-B7E4-0008C73ACA8F}\TypeLib\Version = "4.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{65C53BE7-ED21-4C25-B189-DA0E8FAD5231}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C21B3B1-2B11-45F2-8A9E-DCC5032DE98A}\ = "IMailMerge"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Message\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5FF9F62-0E7C-4372-8AD5-DA7D2418070C}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3A0ACB9-3D8C-4999-9E6B-3E44372E11DD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7aca4b4e58c8092addfb1a56c665827ff04168562f6a6303d21b60e606af875f.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.Recipients\ = "Recipients Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{684130B2-2B8A-4E8D-BE71-8F4052882076}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81CA5571-C109-47AE-BE1C-2DF9CB8999FF}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E05AEA1E-BCB1-473A-8B2A-4829D9E1AD23}\ = "IPGPDecodeResult"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E}\ = "IMessage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65C53BE7-ED21-4C25-B189-DA0E8FAD5231}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90D0A753-AD45-40FD-8C6E-555600EE5EB4}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5FF9F62-0E7C-4372-8AD5-DA7D2418070C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBAAEA4B-AD29-47BD-8776-C787D5BE28AA}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AED3A6B1-2171-11D2-B77C-0008C73ACA8F}\TypeLib\Version = "4.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResults\Clsid\ = "{AC3F1977-CD10-41B2-9977-7693A4C13377}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DECA78-C334-4235-9165-1FE7D8912A76}\ProgID\ = "jmail.Attachment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2ED965-E0BA-4FE4-ADE2-38BD48F112E8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{952F0B99-50B6-44B3-AE0D-700D5B98B416}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}\Version\ = "4.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.SMTPMail\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2ED965-E0BA-4FE4-ADE2-38BD48F112E8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{821AAFE5-2F19-47EB-ACA9-3B4C1D64AC27}\TypeLib\ = "{AED3A6B0-2171-11D2-B77C-0008C73ACA8F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jmail.PGPDecodeResult	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC3F1977-CD10-41B2-9977-7693A4C13377}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F812B147-0E26-4222-8EE4-9F753CD2B39C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{607A06FE-2FDA-4ADC-854D-D016D98D83DB}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E}\TypeLib\Version = "4.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10E321CC-683E-4060-B938-4F53234D9593}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DECA78-C334-4235-9165-1FE7D8912A76}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{607A06FE-2FDA-4ADC-854D-D016D98D83DB}\TypeLib\Version = "4.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A037057-57F0-4904-A1E0-AD0EA2FB564E}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4180 wrote to memory of 3720	4180	regsvr32.exe	regsvr32.exe
PID 4180 wrote to memory of 3720	4180	regsvr32.exe	regsvr32.exe
PID 4180 wrote to memory of 3720	4180	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7aca4b4e58c8092addfb1a56c665827ff04168562f6a6303d21b60e606af875f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\7aca4b4e58c8092addfb1a56c665827ff04168562f6a6303d21b60e606af875f.dll
2⤵
- Modifies registry class
PID:3720

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads